nsg-8100 firewall datasheet丨fs - fiberstore · nsg-8100 incorporates a unified threat detection...

1www.fs.com

NSG-8100 security platform delivers business reliability for large-sized enterprises and data centers.

NSG-8100 Next-Generation Firewall

NSG-8100 Next-Generation Firewall provides comprehensive and

granular visibility and control of applications. It can identify and

prevent potential threats associated with high-risk applications

while providing policy-based control over applications, users, and

user-groups. Policies can be defined that guarantee bandwidth to

• IPS, Anti-Virus, Threat Prevention, Attack

Defense, URL Filtering

• SSL Decryption, Application Control

• IPSec VPN, SSL VPN, L2TP VPN, PnPVPN

• NAT46, NAT64, NAT444, SNAT, DNAT, PAT, Full

Cone NAT, STUN

• iQoS, Traffic Shaping, Bandwidth Allocation

• GUI, CLI (Console, SSH, Telnet), SNMP

Benefits

Next-Generation Firewalls

mission-critical applications while

unauthorized or malicious applications. NSG-8100 provides real-

time protection for applications from network attacks including

viruses, spyware, worms, botnets, ARP spoofing, DoS/DDoS, Trojans,

buffer overflows, and SQL injections. It incorporates comprehensive

network security and advanced firewall features for large-sized

enterprises and data centers.

restricting blocking or

FIREWALLS DATASHEET

2www.fs.com

Key Features

Deployment

NSG-8100 incorporates a unified threat detection engine that share packet details with multiple security engines, including IPS, URL

filtering, Anti-Virus, Attack Defense. It can support application identification and control, data security and load balancing.

NSG-8100 provides comprehensive network security and advanced firewall features for large-sized enterprises and data centers.

Traffic InNSG-8100 NGFW SSL SSL Internal NetworkIPS/URL/Anti-Virus/

Attack Defense

Granular Application Identification and Control

• Provides fine-grained control of web applications regardless of port, protocol, or evasive action.

• It can identify and prevent potential threats associated with high-risk applications while providing policy-based control over

applications, users, and user-groups.

• Security Policies can be defined that guarantee bandwidth to mission-critical applications while restricting or blocking

unauthorized or malicious applications.

Comprehensive Threat Detection and Prevention

• Provides real-time protection for applications from network attacks including viruses, spyware, worms, botnets, ARP spoofing,

DoS/DDoS, Trojans, buffer overflows, and SQL injections.

• It incorporates a unified threat detection engine that share packet details with multiple security engines (AD, IPS, URL filtering,

Anti-Virus).

Superior Network Adaptability

• The intelligent link load balancing greatly promotes the link utilization and user experience for network access to meet the diverse

requirements.

• With VPN acceleration chip, it can significantly improve IPSec/SSL VPN performance and support VPN deployment in large-scale

network environments.

• Supports virtual firewall technology and provides the private security protection service for tenants.

FIREWALLS DATASHEET

3www.fs.com

Panel Overview

NSG-8100

NSG-8100 Next-Generation Firewall combines the most comprehensive security protections to defend your mid-sized to large

enterprises deployments.

Specification

System Specification

Items NSG-8100

Ports 4x GE (RJ45), 4x SFP, 2x SFP+

Firewall Throughput (1) 10 Gbps

NGFW Throughput (2) 3 Gbps

Threat Protection Throughput (3) 2 Gbps

IPS Throughput (4) 4 Gbps

IMIX Throughput (5) 4 Gbps

AV Throughput (6) 3 Gbps

IPSec VPN Throughput (7) 6 Gbps

New Sessions/sec (8) 170,000

Maximum Concurrent Sessions 6 Million

IPSec Tunnel Number 10,000

SSL VPN Users 8/8,000

Intrusion Prevention 1-Year Subscription Included

FIREWALLS DATASHEET

4www.fs.com

Specification

System Specification

Items NSG-8100

Anti-Virus 1-Year Subscription Included

URL Filtering 1-Year Subscription Included

QoS 1-Year Subscription Included

Management Ports1 x Console Port, 1 x AUX Port,

1 x USB Port, 1 x HA, 1 x MGT

Expansion Slots 4 Generic Slots

Maximum Power Consumption 2x 450W, Redundancy 1 + 1

Power Supply Dual

AC Input Power 100-240V, 50/60Hz

DC Input Power -40 to -60V

Warranty 1 Year

Dimension (HxWxD)3.5''x17.3''x 20.9''

(88x440x530 mm)

Weight 27.1 lb (11.8kg)

Temperature 32-104 ℉ (0-40℃)

Relative Humidity 10-95% (no dew)

NOTES:

(1) Firewall throughput data is obtained under single-stack UDP traffic with 1518-byte packet size;

(2) NGFW throughput data is obtained under 64 Kbytes HTTP traffic with application control and IPS enabled;

(3) Threat protection throughput data is obtained under 64 Kbytes HTTP traffic with application control, IPS, AV and URL filtering

enabled;

(4) IPS throughput data is obtained under bi-direction HTTP traffic detection with all IPS rules being turned on;

(5) IMIX throughput data is obtained under UDP traffic mix (64 byte : 512 byte : 1518 byte =5:7:1);

(6) AV throughput data is obtained under HTTP traffic with file attachment;

(7) IPSec VPN throughput data is obtained under Preshare Key AES256+SHA-1 configuration and 1400-byte packet size packet;

(8) New Sessions/s is obtained under TCP traffic.

FIREWALLS DATASHEET

5www.fs.com

Software Features

Software Features and Protocols

Network Services

• Dynamic routing (OSPF, BGP, RIPv2)

• Static and Policy routing

• Route controlled by application

• Built-in DHCP, NTP, DNS Server and DNS proxy

• Tap mode – connects to SPAN port

• Interface modes: sniffer, port aggregated, loopback, VLANS (802.1Q and Trunking)

• L2/L3 switching & routing

• Virtual wire (Layer 1) transparent inline deployment

Firewall

• Operating modes: NAT/route, transparent (bridge), and mixed mode

• Policy objects: predefined, custom, and object grouping

• Security policy based on application, role and geo-location

• Application Level Gateways and session support: MSRCP, PPTP, RAS, RSH, SIP, FTP, TFTP, HTTP,

DCERPC, DNS-TCP, DNS-UDP, H.245 0, H.245 1, H.323

• NAT and ALG support: NAT46, NAT64, NAT444, SNAT, DNAT, PAT, Full Cone NAT, STUN

• NAT configuration: per policy and central NAT table

• VoIP: SIP/H.323/SCCP NAT traversal, RTP pin holing

• Global policy management view

• Security policy redundancy inspection

• Schedules: one-time and recurring

Intrusion Prevention

• Protocol anomaly detection, rate-based detection, custom signatures, manual, automatic

push or pull signature updates, integrated threat encyclopedia

• IPS Actions: default, monitor, block, reset (attackers IP or victim IP, incoming interface) with

expiry time

• Packet logging option

• Filter Based Selection: severity, target, OS, application or protocol

• IP exemption from specific IPS signatures

• IDS sniffer mode

• IPv4 and IPv6 rate based DoS protection with threshold settings against TCP Syn flood,

TCP/UDP/SCTP port scan, ICMP sweep, TCP/UDP/SCIP/ICMP session flooding

(source/destination)

• Active bypass with bypass interfaces

• Predefined prevention configuration

Anti-Virus• Manual, automatic push or pull signature updates

• Flow-based Antivirus: protocols include HTTP, SMTP, POP3, IMAP, FTP/SFTP

• Compressed file virus scanning

FIREWALLS DATASHEET

6www.fs.com

Software Features and Protocols

Attack Defense• Abnormal protocol attack defense

• Anti-DoS/DDoS, including SYN Flood, DNS Query Flood defense

• ARP attack defense

IP Reputation • Botnet server IP blocking with global IP reputation database

URL Filtering

• Flow-based web filtering inspection

• Manually defined web filtering based on URL, web content and MIME header

• Dynamic web filtering with cloud-based real-time categorization database: over 140 million

URLs with 64 categories (8 of which are security related)

• Additional web filtering features:

- Filter Java Applet, ActiveX or cookie

- Block HTTP Post

- Log search keywords

- Exempt scanning encrypted connections on certain categories for privacy

• Web filtering profile override: allows administrator to temporarily assign different profiles to

user/group/IP

• Web filter local categories and category rating override

Botnet C&C Prevention

• Regularly update the botnet server addresses

• prevention for C&C IP and domain

• Support TCP, HTTP, and DNS traffic detection

• IP and domain whitelists

SSL Decryption

• Application identification for SSL encrypted traffic

• IPS enablement for SSL encrypted traffic

• AV enablement for SSL encrypted traffic

• URL filter for SSL encrypted traffic

• SSL Encrypted traffic whitelist

• SSL proxy offload mode

Endpoint Identification

• Support to identify endpoint IP, endpoint quantity, on-line time, off-line time, and on-line

duration

• Support 10 operation systems

• Support query based on IP and endpoint quantity

Data Security

• File transfer control based on file type

• File protocol identification, including HTTP, FTP, SMTP and POP3

• File signature and suffix identification for over 100 file types

• Content filtering for HTTP-GET, HTTP-POST, FTP and SMTP protocols

• IM identification and network behavior audit

FIREWALLS DATASHEET

7www.fs.com

Software Features and Protocols

Application Control

• Over 3,000 applications that can be filtered by name, category, subcategory, technology and

risk

• Each application contains a description, risk factors, dependencies, typical ports used, and

URLs for additional reference

• Actions: block, reset session, monitor, traffic shaping

• Identify and control cloud applications in the cloud

• Provide multi-dimensional monitoring and statistics for cloud applications, including risk

category and characteristics

Quality of Service (QoS)

• Max/guaranteed bandwidth tunnels or IP/user basis

• Tunnel allocation based on security domain, interface, address, user/user group, server/server

group, application/app group, TOS, VLAN

• Bandwidth allocated by time, priority, or equal bandwidth sharing

• Type of Service (TOS) and Differentiated Services (DiffServ) support

• Prioritized allocation of remaining bandwidth

• Maximum concurrent connections per IP

• Bandwidth allocation based on URL category

Server Load Balancing• Weighted hashing, weighted least-connection, and weighted round-robin

• Session protection, session persistence and session status monitoring

• Server health check, session monitoring and session protection

Link Load Balancing

• Bi-directional link load balancing

• Outbound link load balancing includes policy based routing, ECMP and weighted, embedded

ISP routing and dynamic detection

• Inbound link load balancing supports SmartDNS and dynamic detection

• Automatic link switching based on bandwidth, latency, jitter, connectivity, application

• Link health inspection with ARP, PING, and DNS

VPN

• IPSec VPN

- IPSec Phase 1 mode: aggressive and main ID protection mode

- Peer acceptance options: any ID, specific ID, ID in dialup user group

- Supports IKEv1 and IKEv2 (RFC 4306)

- Authentication method: certificate and pre-shared key

- IKE mode configuration support (as server or client)

- DHCP over IPSEC

- Configurable IKE encryption key expiry, NAT traversal keep alive frequency

- Phase 1/Phase 2 Proposal encryption: DES, 3DES, AES128, AES192, AES256

- Phase 1/Phase 2 Proposal authentication: MD5, SHA1, SHA256, SHA384, SHA512

- Phase 1/Phase 2 Diffie-Hellman support: 1,2,5

- XAuth as server mode and for dialup users

- Dead peer detection

- Replay detection

- Autokey keep-alive for Phase 2 SA

FIREWALLS DATASHEET

8www.fs.com

Software Features and Protocols

VPN

• IPSEC VPN realm support: allows multiple custom SSL VPN logins associated with user groups

(URL paths, design)

• IPSEC VPN configuration options: route-based or policy based

• IPSEC VPN deployment modes: gateway-to-gateway, full mesh, hub-and-spoke, redundant

tunnel, VPN termination in transparent mode

• One time login prevents concurrent logins with the same username

• SSL portal concurrent users limiting

• SSL VPN port forwarding module encrypts client data and sends the data to the application

server

• Supports clients that run iOS, Android, and Windows XP/Vista including 64-bit Windows OS

• Host integrity checking and OS checking prior to SSL tunnel connections

• MAC host check per portal

• Cache cleaning option prior to ending SSL VPN session

• L2TP client and server mode, L2TP over IPSEC, and GRE over IPSEC

• View and manage IPSEC and SSL VPN connections

• PnPVPN

VSYS

• System resource allocation to each VSYS

• CPU virtualization

• Non-root VSYS support firewall, IPSec VPN, SSL VPN, IPS, URL filtering

• VSYS monitoring and statistic

IPv6

• Management over IPv6, IPv6 logging and HA

• IPv6 tunneling, DNS64/NAT64 etc

• IPv6 routing protocols, static routing, policy routing, ISIS, RIPng, OSPFv3 and BGP4+

• IPS, Application identification, URL filtering, Anti-Virus, Access control, ND attack defense

High Availability

• Redundant heartbeat interfaces

• Active/Active and Active/Passive

• Standalone session synchronization

• HA reserved management interface

• Failover:

- Port, local & remote link monitoring

- Stateful failover

- Sub-second failover

- Failure notification

• Deployment options:

- HA with link aggregation

- Full mesh HA

- Geographically dispersed HA

FIREWALLS DATASHEET

9www.fs.com

Software Features and Protocols

User and Device Identity

• Local user database

• Remote user authentication: TACACS+, LDAP, Radius, Active

• Single-sign-on: Windows AD

• 2-factor authentication: 3rd party support, integrated token server with physical and SMS

• User and device-based policies

• User group synchronization based on AD and LDAP

• Support for 802.1X, SSO Proxy

• WebAuth page customization

• Interface based Authentication

• Agentless ADSSO (AD Polling)

• Use authentication synchronization based on SSO-monitor

Management

• Management access: HTTP/HTTPS, SSH, telnet, console

• Central Management: Web service APIs

• System Integration: SNMP, syslog, alliance partnerships

• Rapid deployment: USB auto-install, local and remote script execution

• Dynamic real-time dashboard status and drill-in monitoring widgets

Logs & Reporting

• Logging facilities: local memory and storage (if available), multiple syslog servers

• Reliable logging using TCP option (RFC 3195)

• Detailed traffic logs: forwarded, violated sessions, local traffic, invalid packets, URL etc.

• Comprehensive event logs: system and administrative activity audits, routing & networking,

VPN, user authentications, WiFi related events

• IP and service port name resolution option

• Brief traffic log format option

• Three predefined reports: Security, Flow and network reports

• User defined reporting

• Reports can be exported in PDF via Email and FTP

CloudView

• Cloud-based security monitoring

• 7/24 access from web or mobile application

• Device status, traffic and Threat monitoring

• Cloud-based log retention and reporting

FIREWALLS DATASHEET

10www.fs.com

NSG-8100

Default ConfigurationNSG-8100 Next-Generation Firewall, includes 4x GE (RJ45), 4x SFP ports, 4x SFP+ ports, 2 AC power unit,

IPS service, Anti-Virus, QoS, URL filtering service, hardware warranty and software upgrading service. (1

Year)

Ordering Information

NSG-8100 Customized Service

Hardware Options Hardware warranty for 1, 2, 3 years.

Software LicenseQuantity of Virtual System and SSL VPN Concurrent Users.

Software upgrading service for 1, 2, 3 years.

IPS service, Anti-Virus, Botnet, QoS, URL filtering service for 1, 2, 3 years.

NSG-8100 Gigabit INTERFACE CARDS

I/O Ports 8x GE (RJ45) 8x SFP4x GE Bypass (2 pair

bypass ports)4x GE (RJ45) with PoE

Dimension½ U (Occupies 1 generic

slot)

½ U (Occupies 1 generic

slot)

½ U (Occupies 1 generic

slot)

1 U (Occupies 2 generic

slots)

Weight 1.8 lb (0.8kg) 2.0 lb (0.9kg) 1.8 lb (0.8kg) 0.9 lb (0.4kg)

NSG-8100 10 Gigabit INTERFACE CARDS

I/O Ports 4x SFP+ 8x SFP+

Dimension 1 U (Occupies 2 generic slots) 1 U (Occupies 2 generic slots)

Weight 1.5 lb (0.7kg) 1.5 lb (0.7kg)

Business Module Options

NOTE:

1. The optical transceiver module is not included.

2. The interface cards are unavailable online. You can contact with Sales@fs.com freely for your needs. Thanks.

FIREWALLS DATASHEET

11www.fs.com

Accessories

Power Supply (Installed)*2

Rack Mount Brackets*2

Power Cord*2 Console Cable*1

M4 Screw*10

Rubber Pads*4

Cat5e Cables*2

Grounding Cable*1 User Manual*1

M6 Screw+ Nuts*12

Rack Shelf*2

FIREWALLS DATASHEET